Crypto Clipper uses Tor and worm-like propagation for persistence and control

This malware campaign highlights the continued danger of physical media attacks, exploiting user trust in USB drives to deliver malicious .lnk shortcut files that silently install a cryptocurrency clipboard hijacker. Once active, the malware establishes resilient command-and-control over Tor, making it difficult to block or trace, while worm-like propagation ensures it spreads laterally across connected systems. The combination of clipboard theft, backdoor access, and self-replication dramatically amplifies the potential damage from a single infected device. This matters because cryptocurrency transactions are irreversible — once funds are redirected by clipboard manipulation, victims have no recourse for recovery. Organizations and individuals lacking endpoint controls and USB policies are particularly exposed.